AuthorizationPolicy supports both prefix and suffix in a string

Security
1

hello, every one !

I want to know is it possible for AuthorizationPolicy to support both prefix and suffix in one string。

it works fine when either prefix or suffix, for example

apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: tester
  namespace: default
spec:
  selector:
    matchLabels:
      app: products
  action: ALLOW
  rules:
  - when:
    - key: request.auth.claims[key]
        values: ["*test_value"] 

apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: tester
  namespace: default
spec:
  selector:
    matchLabels:
      app: products
  action: ALLOW
  rules:
  - when:
    - key: request.auth.claims[key]
        values: ["test_value*"]

But it not work fine with both suffix value and prefix value as you can see in below code.

apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: tester
  namespace: default
spec:
  selector:
    matchLabels:
      app: products
  action: ALLOW
  rules:
  - when:
    - key: request.auth.claims[key]
        values: ["*test_value*"]

Is there a method to support the above requirements？

2

There’s work/PR in progress around this: Feature/wildcard matching by mstrYoda · Pull Request #35641 · istio/istio · GitHub